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AMENDMENTS TQ THE SPECIFICATION 
Please replace the paragraph on page 6, lines 3-27, vvith the following amended 
paragraph: 

As was noted above, data traverses the Internet 106 as IP datagrams. An IP 
datagram 200, as depicted in FIG. 2, typically includes an IP header portion 202, an upper 
layer protocol (ULP) header 204, and a data payload 206. Examples of an inbound IPSec 
datagram, i.e., an IP datagram subject to ff Sec processing and received at its intended 
destination, are depicted in FIGS> 3 and 4 for tunnel mode and transport mode, 
respectively. As depicted therein, an IPSec datagram 300, 400 includes an IP header 
portion 302, 402, an IPSec header portion 304, 404, and an encrypted and/or 
authenticated payload portion 306, 406. The IP header portion 302, 402 may be either a 
new IP header portion 302, if operating in IPSec tunnel mode (FIG. 3), or the original IP 
header 402 of the unencrypted IP datagram 200, if operating in transport mode (FIG, 4). 
The encrypted and/or authenticated payload portion 306, 406 (represented by the diagonal 
lines) includes encrypted and/or authenticated forms of the data payload portion 206 from 
the unencrypted IP datagram 200. And, if operating in tunnel mode, the encrypted and/or 
authenticated payload portion 306 will also include an encrypted form of the original IP 
header portion 202 and upper layer protocol portion 204. Alternatively, in the transport 
mode, the original upper layer protocol portion 204 is included in its original form. TTxe 
tunnel and transport operational modes are known in the art, and are explained in detail in 
RFC 2401, "System Architecture for the Internet Protocol," the entirety of which is 
hereby incorporated by reference. The IPSec header portion 304, 404 includes, among 
other things, the security protocol (e.g., AH, ESP, or both) 310, 410, and the Security 
Parameter Index (SPI) value 312, 412. The remaining portion of the SA triple, the 
destination address value 308, 408 is included in the IP header portion 302, 402. 

Please replace the paragraph on page 1 0, lines 8-21 , with the following amended 
paragraph: 
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Once the SPI value is assigned and the SA is established, the IPSec hardware 
device 5 10 is able to process inbound IPSec datagrams 300, 400. The skilled artisan will 
appreciate that this processing is generally the same, whether operating in tunnel mode or 
transport mode. Turning now to FIG. 7, the process 700 that is carried out by the IPSec 
hardware device 510 to determine and locate the appropriate SA for the inbound IPSec 
datagrams will be described* The process begins (STEP 702) when the IPSec hardware 
device 510 receives an inbound IPSec datagram 300, 400 via the first I/O bus 509 (STEP 
704), Upon receipt of the IPSec datagram 300, 400, the IPSec hardware device 510 parses 
the IPSec header 304, 404 to locate the SPI value 3 12, 412 (STEP 706). This SPI value is 
then used to locate the memory region in the SAD that has the same address value as the 
SPI value (STEP 708). The S A structure that is stored in that memory region is then used 
as the SA for the inbound IPSec datagram (STEP 710). The process then ends f STEP 
212). 
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